CheckPoint 156-215.71 問題集

質問 1：
Many companies have defined more than one administrator. To increase security, only one administrator should be able to install a Rule Base on a specific Firewall. How do you configure this?
A. In the General Properties of the object representing the specific Firewall, go to the Software Blades product list and select Firewall. Right-click in the menu, select Administrator to Install to define only this administrator.
B. Right-click on the object representing the specific administrator, and select that Firewall in Policy Targets.
C. Define a permission profile in SmartDashboard with read/write privileges, but restrict it to all other firewalls by placing them in the Policy Targets field. Then, an administrator with this permission profile cannot install a policy on any Firewall not listed here.
D. Put the one administrator in an Administrator group and configure this group in the specific Firewall object in Advanced / Permission to Install.
正解：D

質問 2：
You want to create an ASCII formatted output file of the fw monitor command. What is the correct syntax to accomplish this task?
A. fw monitor -e "accept;" -f > /tmp/monitor.txt
B. fw monitor -e "accept;" > /tmp/monitor.txt
C. fw monitor -m iO -e "accept;" -o /tmp/monitor.txt
D. fw monitor -e "accept;" -w /tmp/monitor.txt
正解：B

質問 3：
Which OPSEC server can be used to prevent users from accessing certain Web sites?
A. CVP
B. AMON
C. UFP
D. LEA
正解：C

質問 4：
You just installed a new Web server in the DMZ that must be reachable from the Internet. You create a manual Static NAT rule as follows:

"web_public_IP" is the node object that represents the public IP address of the new Web server. "web_private_IP" is the node object that represents the new Web site's private IP address. You enable all settings from Global Properties > NAT.
When you try to browse the Web server from the Internet, you see the error "page cannot be displayed". Which statements are possible reasons for this?
i) There is no route defined on the Security Gateway for the public IP address to the private IP address of the Web server.
ii) There is no Security Policy defined that allows HTTP traffic to the protected Web server.
iii) There is an ARP entry on the Gateway but the settings Merge Manual proxy ARP and Automatic ARP configuration are enabled in Global Properties. The Security Gateway ignores manual ARP entries.
iv) There is no ARP table entry for the public IP address of the protected Web server.
A. (i), (ii)
B. (iii)
C. (i), (ii), (iii), (iv)
D. (i), (ii), (iv)
正解：B

質問 5：
You cannot use SmartDashboard's SmartDirectory features to connect to the LDAP server. What should you investigate?
A. 1 and 2
B. 1, 2, and 3
C. 2 and 3
D. 1 and 3
正解：C

質問 6：
Which of the following explanations best describes the command fw logswitch [-h target] [+ | -] [oldlog]?
A. Control Kernel
B. Create a new Log file. The old log has moved
C. Display protocol Hosts
D. Display a remote machine's log-file list.
正解：B

質問 7：
What is the officially accepted diagnostic tool for IP appliance support?
A. cpinfo
B. CST
C. Ipsinfo
D. Uag-diag
正解：B

質問 8：
What is the Manual Client Authentication TELNET Port?
A. 264
B. 259
C. 23
D. 900
正解：B

質問 9：
How can you access the Certificate Revocation List (CRL) on the firewall, if you have configured a Stealth Rule as the first explicit rule?
A. The CRL is encrypted, so it is useless to attempt to access it.
B. You can only access the CRI via the Security Management Server as the internal CA is located on that server
C. You can access the Revocation list by means of a browser using the URL: http://IPFW:18264/ICA CRL1.crl1 provided the implied rules are activated per default.
D. You cannot access the CRL, since the Stealth Rule will drop the packets
正解：C